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ABSTRACT 


The accuracy of micrometeoroid and orbital debris 
(MMOD) risk assessments can be difficult to evaluate. A 
team from the National Aeronautics and Space 
Administration (NASA) Engineering and Safety Center 
(NESC) has completed a study that compared MMOD- 
related failures on operational satellites to predictions of 
how many of those failures should occur using NASA’s 
MMOD risk assessment methodology and tools. The 
study team used the Poisson probability to quantify the 
degree of inconsistency between the predicted and 
reported numbers of failures for a selected group of 
robotic satellites. Many elements go into a risk 
assessment, and each of those elements represent a 
possible source of uncertainty or bias that will influence 
the end result. There are also challenges in obtaining 
accurate and useful data on MMOD-related failures. 


1. INTRODUCTION 


Micrometeoroid and orbital debris (MMOD) particles 
traveling at more than 70 km/s (micrometeoroids travel 
at the highest velocities, orbital debris velocities are up to 
~15 km/s) can potentially strike any orbiting spacecraft, 
and MMOD damage is the highest risk factor for most 
spaceflight missions. Spacecraft designers and mission 
planners must satisfy MMOD risk requirements in order 
to ensure that the vehicle can protect human occupants, 
satisfy mission objectives, and preserve the minimum 
capacity needed to perform end-of-mission disposal. 
MMOD risk assessments (MRAs) quantify that impact 
potential based on several factors including the 
spacecraft’s configuration, location, construction, 
operational status, and tolerance to damage. The values 
provided by the MRAs are used to satisfy MMOD 
requirements. So the users of MRAs are interested in 
understanding the accuracy of the MRAs in predicting 
the probability of a failure for their respective spacecraft. 


A team formed by the National Aeronautics and Space 
Administration (NASA) Engineering and Safety Center 
(NESC) sought to define how well NASA’s MRA 
methodology quantified risk by comparing the values 
produced by MRAs to operational spacecraft history. 
Ideally, a study of this kind would use a large dataset 
including many different satellites to obtain an average 
MMOD failure rate and compare this value to an MRA 
average predicted failure rate for that dataset. However, 


this kind of bulk comparison was not practical. Where 
spacecraft failure and anomaly data are available (which 
was not always the case), the team found a wide disparity 
in reporting and cause attribution making it inappropriate 
to combine results. Furthermore, MRAs are time and 
resource intensive, and performing a large number of 
them to encompass a variety of spacecraft was not 
realistic. 


So the team decided to take a “micro-analysis” approach 
and select a few satellites based on the possibility of 
obtaining the data necessary to both determine MMOD 
failures and perform detailed MRAs. The study achieved 
a Statistically significant number of data points by using 
satellite constellations, where the same vehicle design 
was used in several individual spacecraft. This allowed a 
common MRA for the spacecraft but applied throughout 
the constellation. In addition, the MRAs were not 
performed for the spacecraft as a whole, but for 
individual components. For example, the MRA for 
Spacecraft #1 resulted in a predicted number of failures 
not for the spacecraft but for Spacecraft #1’s tanks and 
batteries. This increased the dataset size and allowed the 
team to concentrate on those spacecraft components 
where an MMOD impact failure was relatively easy to 
diagnose (e.g. an MMOD tank failure results in a 
catastrophic rupture of the tank). Finally, with the values 
of predicted number of failures and reported number of 
failures in place, the team could compare them and judge 
the level of consistency between the two, which would in 
turn reflect the relative agreement between the MRA and 
the reported history. 


2. NASA’s MRA PROCESS 


NASA’s Hypervelocity Impact Technology (HVIT) 
group is responsible for most of the MRAs performed to 
support NASA’s programs. Fig. 1 shows HVIT’s MRA 
process and how spacecraft operators and designers use 
it to evaluate MMOD risk and design MMOD protection. 
The MRA tool, Bumper, is at the center of the MRA 
process. As shown in the diagram, Bumper uses input 
including orbital debris and micrometeoroid environment 
models, spacecraft geometry, failure criteria for each 
component and shield included in the analysis, ballistic 
limit equations (BLEs), and operating parameters 
including spacecraft orbit and attitude. Each of these 


input elements can contribute to uncertainty, bias, or 
error in the overall assessed risk produced by Bumper. 
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Figure 1. NASA’s Bumper MRA Process [2] 


The Bumper code uses this information to produce the 
number of events predicted to occur over a given time. 
For simplicity, these events are referred to here as 
“penetrations,” but those events can be MMOD 
penetrations, impacts, or failures, depending on the 
criteria set for the analysis. This result is typically 
presented as a probability of no penetration (PNP), 
determined using Eq. 1: 


PNP =e) (1) 


where e = the base of the natural logarithm (~2.718...), 
and N = number of penetrations calculated. The 
probability of penetration (PP) is simply 1-PNP. PNP and 
PP are typically presented as percentages or odds (e.g., 
1% or 1 in 100). 


The Bumper MRA process is used to iteratively design 
and improve MMOD protection. During design, if a 
Bumper MRA results in a risk greater than what can be 
tolerated, then some of the input parameters can be 
adjusted to observe what the effect on risk will be. The 
predicted number of penetrations is what is predicted to 
occur during a given time period in the future. However, 
for this study, it was necessary to look backward and use 
the MRA to predict how many penetrations (or failures) 
should have occurred starting a given time in the past. 
One of the ramifications of this was a difficulty in 
obtaining some of the needed configuration data for 
spacecraft that have been flying for many years after they 
were designed. 


3. POISSON PROBABILITY 


The Bumper MRA provides a single value for the number 
of predicted failures, and this was compared to the 
number of failures reported to the team. The team desired 
a simple way to quantify this comparison and used the 
Poisson probability for this purpose. The Poisson 


probability is calculated using the generalized version of 
Eq. 1: 


Ake-A 
1 


P(k) = + 


(2) 
where P(k) = the Poisson probability, 4 = the predicted 
number of occurrences, and k = the reported number of 
occurrences. The value for \ is calculated by the MRA, 
and the value for k comes from the failure history. The 
Poisson probability indicates the level of consistency 
between the reported number of occurrences and what 
was predicted to occur. Typically a threshold of 5% or 
below is used to indicate inconsistency. The Poisson 
probability is interpreted as follows: 


There is a P(k)% chance that k occurrences will 
occur given a prediction of A occurring. 


If Pck) is low, then that indicates an inconsistency 
between the reported and predicted, and the cause may be 
either the reporting or predicting or both. The Poisson 
probability should not be confused with the PNP. The 
PNP is an alternative expression of 4, while the Poisson 
probability quantifies how well the PNP agrees with 
reported data. 


4. ROBOTIC SPACECRAFT FAILURE 
ANALYSIS 


4.1. Baseline Analyses 


For this study, the team evaluated three satellite designs 
comprising two constellations and one single satellite. 
This represented a total of 73 individual spacecraft. The 
team performed MRAs for each of the spacecraft’s 
pressurized tanks and batteries; determining a failure for 
these components was relatively unambiguous compared 
to other components. The total exposure time for all of 
the components was 1436.3 years, and the total exposed 
area-time product (i.e., area x time) was 2847.6 m?-year. 
The individual MRA results are shown in Tab. 1. 


Table 1. Failure MRA Results for Robotic Assets 


Asset Component Area- Number 
Time of Failures 
Product Predicted 
(m?-year) 
Satellite#1 | Battery Cell 39.4 0.8 
Tank 12.1 1.1 
Satellite#2 | Battery 349 0.05 
Tank 2253 5.0 
Satellite#3 | Battery Cell 65.1 4.0 
Tank 129 0.4 
Total 2847.6 11.3 


It is important to note that the MRAs for these assets were 
performed based on failure, meaning an MMOD impact 
would have to not only strike the component, but must 
damage it to a degree that the component fails, which for 


tanks is a rupture and batteries is the removal of that 
battery from service (and possibly a rupture also). 


The results in Tab. 1 show that there is a wide variation 
between the number of failures predicted from as low as 
0.05 up to a high of 5.0. The predicted failures can be 
thought of as a failure rate over the respective time frame 
for each satellite (they are different for each satellite 
system). The total number of predicted failures was 11.3 
over the life of the spacecraft assessed. Tab. 2 shows that 
a total of two failures were recorded for the same 
components over the same time period. Tab. 2 also shows 
the Poisson probabilities for each of the assessed 
components based on the predicted versus reported 
failures. 


Table 2. Poisson Probabilities for Robotic Assets 


Component Number Poisson 
of Failures — Probability 
Reported 
Satellite#1 | Battery Cell 0 44% 
GN2 Tank 0 33% 
Satellite#2 | Battery 0 95% 
Tank 1 4% 
Satellite#3 | Battery Cell 0 9% 
Tank 1 10% 
Total 2 0.096 % 


The Poisson probability gives the probability that the 
number of failures reported is consistent with the number 
predicted. For example, there is a 44% probability that 
there would be zero failures of one of Satellite#1’s 
battery cells given the predicted failure rate of 0.8 (from 
Tab. 1). This indicates that the predicted risk and the 
reported failures are consistent. Conversely, the 
Satellite#2 tank reported one failure (Tab. 2), but 5.0 
were predicted (Tab. 1), resulting in a 4% probability that 
if the prediction was correct, there would be | failure. It 
is appropriate to sum the predicted and reported numbers 
of failures to calculate an overall Poisson probability for 
these satellites. Tab. 2 shows that this overall probability 
is only 0.096%, indicating very low consistency. 


4.2. Sensitivity Studies—Tank Wall Thickness 


As shown in Section 2, NASA’s Bumper MRA process 
has several elements that contribute to the result, and 
uncertainties and errors in any of them can have a 
substantial effect on the final result. Elements related to 
how robust exposed regions of the spacecraft are to 
MMOD are important to accurately portray in the MRA. 
For example, because it is integral to the ability of the 
tank to withstand an MMOD impact, the tank wall 
thickness has a substantial effect on the MRA risk. To 
observe the sensitivity of the MRA to tank wall thickness, 
the team performed MRAs with alternative thicknesses 
for Satellite#1 and Satellite#2. 


The initial MRAs performed for Satellite#1 included a 
hydrazine tank, but the team later discovered that this 
tank was only used during ascent. After ascent, the tank 
was isolated from the rest of the hydrazine system and 
any liquid in the tank was allowed to freeze. This meant 
that any MMOD impacts into the tank either may not 
rupture the tank, or might not be detected because that 
subsystem was no longer monitored. The MRAs that did 
include the tank resulted in substantially higher predicted 
failures than when the tank was removed from the MRA. 
There were also conflicting data received by the team on 
the thickness of this tank’s wall. The effects including 
this tank and altering its wall thickness had on the MRA 
and the Poisson probability can be seen in Tab. 3 (there 
were zero reported failures for this tank). 


Table 3. Effect of Tank Wall Thickness on Satellite#1 
Poisson Probability 


Tank Wall Predicted Poisson Total 


Thickness Number Probability Poisson 
(an) of Failures for Probability 
Satellite#1 for all 
Tank Satellites 
Tank Not NA NA 0.096% 
Included 
(Baseline) 
0.178 7.3 0.1% 0.0002% 
0.254 32 4.1% 0.006% 
0.343 1.5 22.3% 0.03% 


For the greatest thicknesses (0.343 cm from Tab. 3), the 
predicted number of failures is relatively consistent with 
the no failures reported, resulting in a Poisson probability 
of 22.3%. However, if thinner tank walls are chosen, the 
predicted numbers of failures are greater by a factor of 
two or three and practically guarantee that every satellite 
in the constellation should have experienced a tank 
penetration and failure. As expected, the Poisson 
probabilities indicate much higher inconsistency between 
predicted and zero reported for the tanks with smaller 
wall thicknesses. 


The team found challenges securing consistent 
configuration tank wall thickness data for Satellite#2 like 
they did for Satellite#1. Two different sources provided 
different thicknesses for the Satellite#2 tank, and neither 
source was judged to be more or less credible than the 
other. For the baseline MRA, 1.0 mm was used as the 
tank thickness because it resulted in a more conservative 
result. A thickness of 1.5 mm was the alternative 
thickness reported to the team. The effect of the 
difference was to reduce the predicted number of failures 
by more than half and reduce the Poisson probability by 
an order of magnitude as shown in Tab. 4. 


Table 4. Effect of Tank Wall Thickness on Poisson 
Probability for Satellite#2 
Tank Wall Predicted Poisson Total 
Thickness Number Probability Poisson 
(mm) of Failures for Probability 
Satellite#2 our 
Tank Satellites 
1.0 (Baseline) 5.0 4% 0.096% 
1.5 1.9 43% 1.15% 


Again, the 0.5 mm variation between tank wall 
thicknesses resulted in a significant change in the 
resulting risk prediction. 


4.3. Sensitivity Study—Failure Reporting 


For Satellite#3, the team modified the reported number 
of failures instead of changing MRA input. Analysis of 
the calculated size and path (provided by the satellite 
operator) of the presumed MMOD particle that 
penetrated the one battery cell that failed revealed that to 
hit the battery cell that failed would have required an 
unlikely (but possible) path to negotiate a crowded region 
in front of the target. Another cause of the battery failure, 
which would have had to produce not only the loss of 
performance but also an observed attitude perturbation to 
the spacecraft, was unlikely but also possible. If this 
second scenario had occurred, then the reported number 
of MMOD failures for this component would have been 
reduced from one to zero. Tab. 5 shows that for the 
battery alone, the Poisson probability decreases from a 
marginally inconsistent 9% to a strongly inconsistent 2% 
when removing the single reported failure. The effect on 
the total Poisson probability for all of the assets is 
negligible; the baseline value was already very low (..e., 
very low consistency), and the change only reinforced 
that. When trying to determine the size particle that 
caused a recorded perturbation, there are numerous 
assumptions and guesses that have to be made including 
the velocity, size, composition, direction, and shape of 
the particle. These parameters are interrelated in how 
they produce the perturbation witnessed by the spacecraft 
operators, and changes in one will affect the estimated 
and calculated values for the others. 


Table 5. Effect of Number of Reported Failures on 


Poisson Probability 

Number of Predicted Poisson Total 

Wo oleyarerel Number Probability Poisson 
Battery of Failures for Probability 

Failures Due Satellite#1 for all 
irom AY (OB) Tank Satellites 
1 (baseline) 4.0 9% 0.096% 
0 4.0 2% 0.015% 


5. ROBOTIC SPACECRAFT IMPACT 
ANALYSIS 


The MRAs described in Section 4 were failure risk 
assessments, meaning the criteria used to establish the 


risk (i.e. predicted number of events) were component 
failures. However, each spacecraft, and each component, 
is impacted by many more MMOD particles that do not 
cause a failure than those that do. An impact risk 
assessment, as opposed to a failure risk assessment, will 
predict the number of impacts a component will 
experience. Impact MRAs do not require as much data 
concerning the material characteristics and damage 
modes since what is sought is simply how many times the 
spacecraft is hit. However, it is much more difficult to 
determine when a component is impacted if there is no 
indication (failure is an obvious indication) visible to the 
spacecraft controllers. 


Fortunately, one of the spacecraft operators that provided 
the team with failure data also provided the team orbit 
perturbation events that occurred on some of their 
spacecraft that did not result in a failure. These were 
uncommanded changes in the spacecraft velocity, which 
resulted in changes to the vehicle altitude, and pitch, yaw, 
and roll. The spacecraft operator determined that the 
probable cause of these events was MMOD impacts. The 
locations in the orbit of each of the impacts were 
consistent with orbital debris (as opposed to 
micrometeoroid or other failure causes). This is seen in 
Fig. 2, which displays the cumulative distribution of 
satellite latitude where each anomaly occurred (blue line) 
against what would be predicted by NASA’s orbital 
debris environment model, the Orbital Debris 
Engineering Model Version 3.0 (ORDEM3.0) (red line). 
The black dashed line represents where the data would 
fall if it were random, as would be expected with 
micrometeoroids. 
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Figure 2. Latitude Distribution of Anomaly Events 


The team used these measurements to determine the 
momentum imparted to the spacecraft and _ the 
momentum of the MMOD particle. The momentum 
could then be converted to a particle size dependent on 
assumptions of velocity and shape. The average orbital 
debris particle velocity at that altitude is 13.94 km/s 
according to ORDEM3.0, so that was taken as the impact 


velocity. With a velocity, the team could calculate a 
mass. ORDEM3.0 is expressed in terms of characteristic 
length (Lc), a measure of the average of the longest 
dimension of the particle and the two dimensions 
orthogonal to that longest dimension (e.g., for a sphere, 
all three of those dimensions are equal). To get the Lc 
from a mass requires assuming a shape and density. In 
most MRAs, and all those performed by NASA/HVIT, 
the shape of each piece of orbital debris is assumed to be 
spherical. However, a sphere has the highest mass 
possible for a given Lc, so using this assumption results 
in the highest particle mass, and greatest assessed risk 
possible. Looking at it another way, the mass for the 
sphere will result in the smallest possible Lc. Using the 
spherical assumption and the density of aluminum, the 
particle size (i.e., Lc ) for each of the impact events was 
estimated using the calculated momenta. The impact 
frequency for these size particles was then compared to 
what would be expected using ORDEM3.0. 


An additional consideration is the momentum 
enhancement factor (MEF). This is the additional 
momentum that is imparted to the satellite from the 
impact ejecta. Because this ejecta has mass originating 
from the spacecraft and is travelling in the direction 
opposite the direction of the incoming MMOD particle, a 
force is directed against the spacecraft in the same 
direction as the simple momentum exchange of the 
MMOD particle to the spacecraft. This MEF has been 
experimentally measured for different types of materials 
[8, 9, 10], and is estimated for this case to be between 1- 
3 (ie., an MEF of 1! would mean no additional 
momentum is exchanged). Assuming an MEF of 1, 
ORDEM3.0 would predict 24 impacts in the size range 
observed/calculated. When an MEF of 2 is assumed, the 
predicted number of impacts increases to 70 because 
smaller particles are required to produce the same net 
momentum observed, and there are more smaller 
particles—thus more impacts. If an MEF of 3 is chosen, 
there would be 164 impacts. Any of these values is 
greater than the six impacts registered. 


The team then investigated the results if a shape other 
than a sphere was used for the orbital debris. Different 
shapes were applied to the results including oblate 
ellipsoids and octahedrons. A sphere with voids was also 
explored, which resulted in a reduced net density that 
varied as a function of critical length (Lc®”, Lo, 
Le®®, Lo!) . This “voided sphere” is analogous to a 
debris particle that may have material folded over on 
itself or crumpled like a sheet of paper, resulting in a 
nonhomogeneous density. When these different shapes 
were applied to ORDEM3.0, the number of impacts was 
reduced. The degree of reduction varied depending on the 
shape assumed. Fig. 3 shows the curves for each of the 
shape/voided spheres plotted on a log-log scale as a 
function of momentum versus flux. The blue line on the 


graph represents the baseline spherical assumption, the 
red lines represent the impacts (one red line includes a 
catastrophic impact in addition to the other six), and the 
other lines are different shapes as indicated in the legend. 
As can be seen on the figure, the data for the impacts are 
more consistent with the curves for the voided spheres 
and the octahedron than for spheres. 
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Figure 3. Predicted Orbital Debris Flux as a Function 
of Impact Momentum (MEF=2) 


Any decrease in flux as a function of momentum (i.e., 
any of the lines in Fig. 3 below the blue one) would 
represent a reduction in risk when applied to an MRA. So 
if alternative shapes to spheres are applied to ORDEM3.0 
and Bumper, then the end result would be a reduction in 
risk. However, the shape and orientation of an impacting 
projectile can influence the penetration characteristics of 
the projectile. Consider the different damage that would 
be caused by a rod-shaped particle if that particle 
impacted on the pointed end versus the flat side. These 
penetration characteristics would need consideration and 
may, to some degree, counteract risk improvements made 
with alternative shapes. 


6. CAUSES OF INCONSISTENCIES 


The overall results for this very limited number of robotic 
spacecraft indicate that the predicted number of failures 
is inconsistent with the reported number. This means that 
either the failure predictions are overpredicted, failures 
are under-reported, or a combination of these factors is 
responsible. Most likely, the inconsistencies are a result 
of a combination of error or bias that stem from 
uncertainties present in several sources on the prediction 
and reporting sides. This section discusses some of these 
sources of uncertainty that can result in inaccurate and/or 
inconsistent results. 


Some of the causes of uncertainty or bias in the MRAs 
are: 


e Sensitivity to design parameters, such as 
dimensions and materials (e.g., the ambiguity of 


the tank wall thicknesses discussed in Section 
4). Design and construction details are routinely 
unavailable, difficult to obtain, or contain 
unusual construction features and might require 
assumptions based on engineering judgment. 
This is especially true for spacecraft already on 
orbit and far removed from design and 
construction, as was the case in this study. Even 
for spacecraft currently in development, there 
can be issues obtaining accurate input 
information due to proprietary or classified data 
or the actual build differing from drawings. 

e MMOD shape represented as solid spheres in 
ORDEM3.0 and Bumper. As discussed in 
Section 5, spheres represent the maximum 
possible mass for a given characteristic length 
and density. The impact assessment showed that 
using different shapes and voided spheres 
results in reduced assessed risk. However, the 
complex interaction of mass, shape, orientation, 
and size-dependent debris flux affects the 
overall risk of nonspherical particles compared 
to that of the solid sphere assumption. 

e A lack of applicable test data for most robotic 
spacecraft MRAs. NASA uses BLEs derived 
from testing and analysis for crewed vehicles, 
which differ in materials and layup from typical 
satellite construction. 

e Limitations of HVI testing. BLEs must be 
extrapolated in order to represent on-orbit 
collision velocities since most HVI testing is 
typically only up to 10 km/s. Compare that to 
orbital debris relative impact velocity up to 15 
km/s, and up to 72 km/sec for micrometeoroids. 

e Worst-case assumptions for component failure 
conditions, especially in first order risk 
assessments. As more information is gathered 
and a more detailed and accurate spacecraft 
configuration is applied to the MRA, the 
assessed risk tends to decrease. 

e Limited HVI test data to derive BLEs. 
Statistically-based uncertainty bounds are not 
normally derived due to limited HVI data. 


Challenges associated with using spacecraft failure and 
anomaly data include: 


e A lack of consistency in categorizing and 
reporting anomalies across the aerospace 
community. 

e —_ Lack of experience in the process of associating 
failures to causative mechanisms. Observed 
failures may be the result of a combination of 
multiple events occurring on the spacecraft. 

e Lack of motivation on the part of spacecraft 
operators to fully investigate the root cause of 
an anomaly or failure. Many commercial 


operators prioritize returning the spacecraft to 
service rather than spending resources 
troubleshooting and identifying the cause of an 
anomaly. 

e Reluctance on the part of spacecraft operators to 
share anomaly data due to privacy fears or a 
perception that public disclosure of failures will 
reflect negatively on the company. 

e A lack of adequate onboard sensors, and 
requirements to provide those sensors, to 
measure physical perturbations to better 
correlate particulate impacts to failure 
mechanisms. 

e Unavailability of telemetered data, especially 
after a catastrophic failure. 

e —_ Lack of understanding and natural variability in 
other MMOD failure mechanisms (e.g., plasma) 
other than physical penetration and ejecta. 


7. CONCLUSION 


A primary conclusion of this study is that verifying the 
accuracy of the MRAs can be very challenging. For the 
limited sample set used in this study, there is an overall 
inconsistency between the magnitude of predicted risk 
and the actual number of MMOD-induced failures 
reported. There are uncertainties for both the prediction 
and the reported that could be contributing to the 
inconsistencies. The team used Poisson probabilities as a 
tool to illustrate the inconsistencies quantitatively. These 
values are not meant to be applied to other spacecraft. 


Much attention recently has been given to ORDEM3.0 as 
a contributor to uncertainty. MRAs performed using 
ORDEM3.0 have, in many cases, resulted in higher 
assessed risk. Indeed, the impact analysis in this study 
looking at spacecraft perturbations shows that perhaps 
the number of impacts expected by the model is greater 
than what is occurring. However, those results are only 
focused on a narrow range of particle sizes—particles 
large enough to perturb the orbit of the affected satellites. 
The study did not gain any insight to how well 
ORDEM3.0 is representing particles smaller or larger 
than ~3-5 mm. The team also showed promising data in 
evaluating a more appropriate shape for orbital debris and 
how this may improve this element of the risk 
assessment. At least two tests have been performed 
where a grounded satellite has been impacted by a 
hypervelocity projectile under laboratory conditions, and 
the resulting debris was counted, measured, and 
catalogued by shape [11, 12]. The data from these 
experiments might be useful to characterize orbital debris 
shape for use in MRAs. 


The component failure analyses for the robotic spacecraft 
revealed a wide range of Poisson probabilities for the 
different components, even on the same spacecraft. This 
seems to imply that there is more contributing to MRA 


uncertainty than simply ORDEM3.0 since all of the 
component MRAs used the same ORDEM3.0, but not all 
had the same degree of inconsistency. The team showed 
how important knowing the accurate design parameters 
of the spacecraft/component is by varying tank wall 
thicknesses and getting very different predicted failure 
results. If a tank wall thickness was a little thicker than 
originally thought, then it would take a larger MMOD 
particle to penetrate that tank, and the population of 
MMOD particles decreases as they get larger. Other 
sources of error and uncertainty as discussed in Section 
7, while not targeted in this study, offer contributions that 
may be in the same order of magnitude as the shape effect 
and tank wall thicknesses as far as influencing the 
inconsistencies in this study and in general. 


There are opportunities for improvement on the MRA 
side and the anomaly tracking side. Jn situ measurement 
of MMOD impacts and continued use of returned 
impacted surfaces will help refine and upgrade 
environment models. HVI testing on materials and 
components specific to the spacecraft being assessed 
(when possible) will help to improve damage prediction 
and assignment of failure criteria. Standardization of 
anomaly reporting and characterization, and a greater 
willingness to share that information, will help to 
understand actual failure rates. With robotic spacecraft 
having to meet end-of-mission disposal requirements, the 
robotic community is taking a greater interest in MMOD 
protection than previously—a risk that has been familiar 
to the crewed missions for a long time. 
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